dependency-cruiser 17.3.2 → 17.3.3-beta-2

package/src/main/report-wrap.mjs

@@ -17,34 +17,34 @@ import stripSelfTransitions from "#graph-utl/strip-self-transitions.mjs";
  * @returns {ICruiseResult}
  */
 function reSummarizeResults(pResult, pFormatOptions) {
-  let lModules = applyFilters(pResult.modules, pFormatOptions);
+	let lModules = applyFilters(pResult.modules, pFormatOptions);
 
-  if (Object.hasOwn(pFormatOptions, "collapse")) {
-    lModules = consolidateToPattern(lModules, pFormatOptions.collapse)
-      .sort(compareModules)
-      .map(stripSelfTransitions);
-  }
-  return {
-    ...pResult,
-    summary: {
-      ...pResult.summary,
-      ...summarize(
-        lModules,
-        {
-          ...pResult.summary.optionsUsed,
-          ...pFormatOptions,
-        },
-        (pResult.summary.optionsUsed.args || "").split(" "),
-        // TODO: apply filters to the folders too
-        pResult.folders,
-      ),
-    },
-    modules: lModules,
-  };
+	if (Object.hasOwn(pFormatOptions, "collapse")) {
+		lModules = consolidateToPattern(lModules, pFormatOptions.collapse)
+			.sort(compareModules)
+			.map(stripSelfTransitions);
+	}
+	return {
+		...pResult,
+		summary: {
+			...pResult.summary,
+			...summarize(
+				lModules,
+				{
+					...pResult.summary.optionsUsed,
+					...pFormatOptions,
+				},
+				(pResult.summary.optionsUsed.args || "").split(" "),
+				// TODO: apply filters to the folders too
+				pResult.folders,
+			),
+		},
+		modules: lModules,
+	};
 }
 
 function getReporterSection(pOutputType) {
-  return pOutputType === "x-dot-webpage" ? "dot" : pOutputType;
+	return pOutputType === "x-dot-webpage" ? "dot" : pOutputType;
 }
 
 /**
@@ -54,18 +54,18 @@ function getReporterSection(pOutputType) {
  * @returns {IReporterOutput}
  */
 export default async function reportWrap(pResult, pFormatOptions) {
-  const lReportFunction = await getReporter(pFormatOptions.outputType);
-  const lReportOptions =
-    pResult.summary.optionsUsed?.reporterOptions?.[
-      getReporterSection(pFormatOptions.outputType)
-    ] ?? {};
+	const lReportFunction = await getReporter(pFormatOptions.outputType);
+	const lReportOptions =
+		pResult.summary.optionsUsed?.reporterOptions?.[
+			getReporterSection(pFormatOptions.outputType)
+		] ?? {};
 
-  return lReportFunction(
-    reSummarizeResults(pResult, pFormatOptions),
-    // passing format options here so reporters that read collapse patterns
-    // from the result take the one passed in the format options instead
-    Object.hasOwn(pFormatOptions, "collapse")
-      ? { ...lReportOptions, collapsePattern: pFormatOptions.collapse }
-      : lReportOptions,
-  );
+	return lReportFunction(
+		reSummarizeResults(pResult, pFormatOptions),
+		// passing format options here so reporters that read collapse patterns
+		// from the result take the one passed in the format options instead
+		Object.hasOwn(pFormatOptions, "collapse")
+			? { ...lReportOptions, collapsePattern: pFormatOptions.collapse }
+			: lReportOptions,
+	);
 }

package/src/main/resolve-options/normalize.mjs

@@ -2,8 +2,8 @@ import fs from "node:fs";
 import enhancedResolve from "enhanced-resolve";
 import { scannableExtensions } from "#extract/transpile/meta.mjs";
 import {
-  ruleSetHasDeprecationRule,
-  ruleSetHasLicenseRule,
+	ruleSetHasDeprecationRule,
+	ruleSetHasLicenseRule,
 } from "#graph-utl/rule-set.mjs";
 
 /**
@@ -14,33 +14,32 @@ import {
 const DEFAULT_CACHE_DURATION = 4000;
 /** @type {Partial<IResolveOptions>} */
 const DEFAULT_RESOLVE_OPTIONS = {
-  symlinks: true,
-  // if a webpack config overrides extensions, there's probably
-  // good cause. The scannableExtensions are an educated guess
-  // anyway, that works well in most circumstances.
-  // Note that if extract/transpile/index gets an unknown extension
-  // passed, it'll fall back to the javascript parser
-  extensions: scannableExtensions,
-  // for typescript projects that import stuff that's only in
-  // node_modules/@types we need:
-  // - the inclusion of .d.ts to the extensions (see above)
-  // - an explicit inclusion of node_modules/@types to the spots
-  //   to look for modules (in addition to "node_modules" which
-  //   is the default for enhanced-resolve)
-  modules: ["node_modules", "node_modules/@types"],
-  // this overrides the default exports fields enhanced-resolve uses
-  // (being ["exports"]) to keep backwards compatibility between enhanced-resolve
-  // 4 and 5 (4 didn't heed them at all and the empty array has the same
-  // effect).
-  // Also see https://github.com/sverweij/dependency-cruiser/issues/338
-  exportsFields: [],
+	symlinks: true,
+	// if a webpack config overrides extensions, there's probably
+	// good cause. The scannableExtensions are an educated guess
+	// anyway.Note: if extract/transpile/index gets an unknown extension
+	// it'll fall back to the javascript parser
+	extensions: scannableExtensions,
+	// for typescript projects that import stuff that's only in
+	// node_modules/@types we need:
+	// - the inclusion of .d.ts to the extensions (see above)
+	// - an explicit inclusion of node_modules/@types to the spots
+	//   to look for modules (in addition to "node_modules" which
+	//   is the default for enhanced-resolve)
+	modules: ["node_modules", "node_modules/@types"],
+	// this overrides the default exports fields enhanced-resolve uses
+	// (being ["exports"]) to keep backwards compatibility between enhanced-resolve
+	// 4 and 5 (4 didn't heed them at all and the empty array has the same
+	// effect).
+	// Also see https://github.com/sverweij/dependency-cruiser/issues/338
+	exportsFields: [],
 };
 
 function omit(pObject, pProperty) {
-  const lObject = structuredClone(pObject);
-  // eslint-disable-next-line security/detect-object-injection
-  delete lObject[pProperty];
-  return lObject;
+	const lObject = structuredClone(pObject);
+	// eslint-disable-next-line security/detect-object-injection
+	delete lObject[pProperty];
+	return lObject;
 }
 
 /**
@@ -49,89 +48,89 @@ function omit(pObject, pProperty) {
  * @returns {Partial<IResolveOptions>}
  */
 function getNonOverridableResolveOptions(pCacheDuration) {
-  return {
-    // This should cover most of the bases of dependency-cruiser's
-    // uses. Not overridable for now because for other
-    // file systems it's not sure we can use sync system calls
-    // Also: passing a non-cached filesystem makes performance
-    // worse.
-    fileSystem: new enhancedResolve.CachedInputFileSystem(fs, pCacheDuration),
-    // our code depends on sync behavior, so having this
-    // overridden is not an option
-    useSyncFileSystemCalls: true,
-  };
+	return {
+		// This should cover most of the bases of dependency-cruiser's
+		// uses. Not overridable for now because for other
+		// file systems it's not sure we can use sync system calls
+		// Also: passing a non-cached filesystem makes performance
+		// worse.
+		fileSystem: new enhancedResolve.CachedInputFileSystem(fs, pCacheDuration),
+		// our code depends on sync behavior, so having this
+		// overridden is not an option
+		useSyncFileSystemCalls: true,
+	};
 }
 
 function pushPlugin(pPlugins, pPluginToPush) {
-  return (pPlugins || []).concat(pPluginToPush);
+	return (pPlugins || []).concat(pPluginToPush);
 }
 
 // eslint-disable-next-line max-lines-per-function
 async function compileResolveOptions(
-  pResolveOptions,
-  pTSConfig,
-  pResolveOptionsFromDCConfig,
+	pResolveOptions,
+	pTSConfig,
+	pResolveOptionsFromDCConfig,
 ) {
-  let lResolveOptions = {};
+	let lResolveOptions = {};
 
-  // There's a performance impact of ~1 ms per resolve even when there
-  // are 0 paths in the tsconfig, so not loading it when not necessary
-  // will be a win.
-  // Also: requiring the plugin only when it's necessary will save some
-  // startup time (especially on a cold require cache)
-  if (pResolveOptions.tsConfig) {
-    const { default: TsConfigPathsPlugin } =
-      await import("tsconfig-paths-webpack-plugin");
-    lResolveOptions.plugins = pushPlugin(
-      lResolveOptions.plugins,
-      // @ts-expect-error TS2351 "TsConfPathsPlugin is not constructable" - is unjustified
-      new TsConfigPathsPlugin({
-        configFile: pResolveOptions.tsConfig,
-        // TsConfigPathsPlugin requires a baseUrl to be present in the tsconfig,
-        // otherwise it prints scary messages that it didn't and read the tsConfig
-        // (potentially making users think it's dependency-cruiser disregarding the
-        // tsconfig). Hence up till version 13.0.4 dependency-cruiser only loaded
-        // TsConfigPathsPlugin when an options.baseUrl existed. However, this
-        // isn't necessary anymore:
-        // - [tsconfig#baseUrl documentation](https://www.typescriptlang.org/tsconfig#baseUrl)
-        //   UNrecommends the use of the baseUrl for non-AMD projects
-        // - [tsconfig-paths PR #207](https://github.com/dividab/tsconfig-paths/pull/208)
-        //   'tolerates' undefined baseUrls
-        //
-        // Hence, until
-        // [tpwp issue #99](https://github.com/dividab/tsconfig-paths-webpack-plugin/issues/99)
-        // lands:
-        // - pass a default baseUrl to TsConfigPathsPlugin if the baseUrl isn't available
-        // - pass undefined in all other cases; TsConfigPathsPlugin will read
-        //   it from the tsconfig.json in that case. Passing the processed baseUrl
-        //   (pTSConfig?.options?.baseUrl) instead would've been more obvious, but
-        //   doesn't work, as that is an absolute path and tsconfig-paths(-wpp)
-        //   seems to process that again resulting in invalid paths and unresolved
-        //   or erroneous dependencies
-        // eslint-disable-next-line no-undefined
-        baseUrl: pTSConfig?.options?.baseUrl ? undefined : "./",
-        // TsConfigPathsPlugin doesn't (can't) read enhanced-resolve's
-        // list of extensions, and the default it uses for extensions
-        // so we do it ourselves - either with the extensions passed
-        // or with the supported ones.
-        extensions:
-          pResolveOptionsFromDCConfig.extensions ||
-          pResolveOptions.extensions ||
-          DEFAULT_RESOLVE_OPTIONS.extensions,
-      }),
-    );
-  }
+	// There's a performance impact of ~1 ms per resolve even when there
+	// are 0 paths in the tsconfig, so not loading it when not necessary
+	// will be a win.
+	// Also: requiring the plugin only when it's necessary will save some
+	// startup time (especially on a cold require cache)
+	if (pResolveOptions.tsConfig) {
+		const { default: TsConfigPathsPlugin } =
+			await import("tsconfig-paths-webpack-plugin");
+		lResolveOptions.plugins = pushPlugin(
+			lResolveOptions.plugins,
+			// @ts-expect-error TS2351 "TsConfPathsPlugin is not constructable" - is unjustified
+			new TsConfigPathsPlugin({
+				configFile: pResolveOptions.tsConfig,
+				// TsConfigPathsPlugin requires a baseUrl to be present in the tsconfig,
+				// otherwise it prints scary messages that it didn't and read the tsConfig
+				// (potentially making users think it's dependency-cruiser disregarding the
+				// tsconfig). Hence up till version 13.0.4 dependency-cruiser only loaded
+				// TsConfigPathsPlugin when an options.baseUrl existed. However, this
+				// isn't necessary anymore:
+				// - [tsconfig#baseUrl documentation](https://www.typescriptlang.org/tsconfig#baseUrl)
+				//   UNrecommends the use of the baseUrl for non-AMD projects
+				// - [tsconfig-paths PR #207](https://github.com/dividab/tsconfig-paths/pull/208)
+				//   'tolerates' undefined baseUrls
+				//
+				// Hence, until
+				// [tpwp issue #99](https://github.com/dividab/tsconfig-paths-webpack-plugin/issues/99)
+				// lands:
+				// - pass a default baseUrl to TsConfigPathsPlugin if the baseUrl isn't available
+				// - pass undefined in all other cases; TsConfigPathsPlugin will read
+				//   it from the tsconfig.json in that case. Passing the processed baseUrl
+				//   (pTSConfig?.options?.baseUrl) instead would've been more obvious, but
+				//   doesn't work, as that is an absolute path and tsconfig-paths(-wpp)
+				//   seems to process that again resulting in invalid paths and unresolved
+				//   or erroneous dependencies
+				// eslint-disable-next-line no-undefined
+				baseUrl: pTSConfig?.options?.baseUrl ? undefined : "./",
+				// TsConfigPathsPlugin doesn't (can't) read enhanced-resolve's
+				// list of extensions, and the default it uses for extensions
+				// so we do it ourselves - either with the extensions passed
+				// or with the supported ones.
+				extensions:
+					pResolveOptionsFromDCConfig.extensions ||
+					pResolveOptions.extensions ||
+					DEFAULT_RESOLVE_OPTIONS.extensions,
+			}),
+		);
+	}
 
-  return {
-    ...DEFAULT_RESOLVE_OPTIONS,
-    ...lResolveOptions,
-    ...omit(pResolveOptionsFromDCConfig, "cachedInputFileSystem"),
-    ...pResolveOptions,
-    ...getNonOverridableResolveOptions(
-      pResolveOptionsFromDCConfig?.cachedInputFileSystem?.cacheDuration ??
-        DEFAULT_CACHE_DURATION,
-    ),
-  };
+	return {
+		...DEFAULT_RESOLVE_OPTIONS,
+		...lResolveOptions,
+		...omit(pResolveOptionsFromDCConfig, "cachedInputFileSystem"),
+		...pResolveOptions,
+		...getNonOverridableResolveOptions(
+			pResolveOptionsFromDCConfig?.cachedInputFileSystem?.cacheDuration ??
+				DEFAULT_CACHE_DURATION,
+		),
+	};
 }
 
 /**
@@ -142,40 +141,40 @@ async function compileResolveOptions(
  */
 // eslint-disable-next-line complexity
 export default async function normalizeResolveOptions(
-  pResolveOptions,
-  pOptions,
-  pTSConfig,
+	pResolveOptions,
+	pOptions,
+	pTSConfig,
 ) {
-  const lRuleSet = pOptions?.ruleSet ?? {};
+	const lRuleSet = pOptions?.ruleSet ?? {};
 
-  return await compileResolveOptions(
-    {
-      // EnhancedResolve's symlinks:
-      // - true => symlinks are followed (vv)
-      // node's --preserve-symlinks:
-      // - true => symlinks are NOT followed (vv)
-      // => symlinks = !preserveSymlinks
-      symlinks: !pOptions?.preserveSymlinks,
-      tsConfig:
-        pOptions?.tsConfig?.fileName ??
-        pOptions?.ruleSet?.options?.tsConfig?.fileName ??
-        null,
+	return await compileResolveOptions(
+		{
+			// EnhancedResolve's symlinks:
+			// - true => symlinks are followed (vv)
+			// node's --preserve-symlinks:
+			// - true => symlinks are NOT followed (vv)
+			// => symlinks = !preserveSymlinks
+			symlinks: !pOptions?.preserveSymlinks,
+			tsConfig:
+				pOptions?.tsConfig?.fileName ??
+				pOptions?.ruleSet?.options?.tsConfig?.fileName ??
+				null,
 
-      /* squirrel the externalModuleResolutionStrategy and combinedDependencies
+			/* squirrel the externalModuleResolutionStrategy and combinedDependencies
          thing into the resolve options
          - they're not for enhanced resolve, but they are for what we consider
          resolve options ...
        */
-      combinedDependencies: pOptions?.combinedDependencies ?? false,
-      /* Same for the builtInModules override/ add option ...*/
-      ...(pOptions?.builtInModules?.override || pOptions?.builtInModules?.add
-        ? { builtInModules: pOptions?.builtInModules }
-        : {}),
-      resolveLicenses: ruleSetHasLicenseRule(lRuleSet),
-      resolveDeprecations: ruleSetHasDeprecationRule(lRuleSet),
-      ...pResolveOptions,
-    },
-    pTSConfig || {},
-    pOptions?.enhancedResolveOptions ?? {},
-  );
+			combinedDependencies: pOptions?.combinedDependencies ?? false,
+			/* Same for the builtInModules override/ add option ...*/
+			...(pOptions?.builtInModules?.override || pOptions?.builtInModules?.add
+				? { builtInModules: pOptions?.builtInModules }
+				: {}),
+			resolveLicenses: ruleSetHasLicenseRule(lRuleSet),
+			resolveDeprecations: ruleSetHasDeprecationRule(lRuleSet),
+			...pResolveOptions,
+		},
+		pTSConfig || {},
+		pOptions?.enhancedResolveOptions ?? {},
+	);
 }

package/src/main/rule-set/assert-validity.mjs

@@ -1,105 +1,99 @@
-import Ajv from "ajv";
 import safeRegex from "safe-regex";
 import { assertCruiseOptionsValid } from "../options/assert-validity.mjs";
 import { normalizeToREAsString } from "../helpers.mjs";
-import configurationSchema from "#configuration-schema";
+import { bus } from "#utl/bus.mjs";
 import { has, get } from "#utl/object-util.mjs";
+import validateConfigurationSchema from "#schema/configuration.validate.mjs";
+import { validateErrorsToString } from "#schema/utl.mjs";
+
 /**
  * @import { IConfiguration } from "../../../types/configuration.mjs";
  */
 
-const ajv = new Ajv();
-// the default for this is 25 - as noted in the safe-regex source code already,
-// the repeat limit is not the best of heuristics for indicating exponential time
-// regular expressions - and it leads to false positives. E.g. if you use rules
-// 'generated' from rules it could be the generated 'from' or 'to' have a list
-// of file patterns that's easily > 25 of length. It's currently not possible
-// to disable this check in safe-regex (e.g. by setting it to an odd value like
-// 0 or -1, or by passing a 'switch this thing off please' option), so the only
-// option is to increase the repeat limit to something fairly high.
-//
-// This does _not_ influence the star height algorithm, which is the main value
-// of the safe-regex package.
+// Bump safe-regex repeat limit to 10000 to avoid false positives
+// for long pattern lists. This does not affect the star-height safety check.
 const MAX_SAFE_REGEX_STAR_REPEAT_LIMIT = 10000;
 
-function assertSchemaCompliance(pSchema, pConfiguration) {
-  if (!ajv.validate(pSchema, pConfiguration)) {
-    throw new Error(
-      `The supplied configuration is not valid: ${ajv.errorsText()}.\n`,
-    );
-  }
+function assertSchemaCompliance(pConfiguration) {
+	if (!validateConfigurationSchema(pConfiguration)) {
+		throw new Error(
+			`The supplied configuration is not valid: ${validateErrorsToString(validateConfigurationSchema.errors)}.\n`,
+		);
+	}
 }
 
 function hasPath(pObject, pSection, pCondition) {
-  // pCondition can be nested properties, so we use a bespoke
-  // 'has' function instead of simple elvis operators
-  return has(pObject, pSection) && has(pObject[pSection], pCondition);
+	// pCondition can be nested properties, so we use a bespoke
+	// 'has' function instead of simple elvis operators
+	return has(pObject, pSection) && has(pObject[pSection], pCondition);
 }
 
 function safeRule(pRule, pSection, pCondition) {
-  return (
-    !hasPath(pRule, pSection, pCondition) ||
-    safeRegex(normalizeToREAsString(get(pRule[pSection], pCondition)), {
-      limit: MAX_SAFE_REGEX_STAR_REPEAT_LIMIT,
-    })
-  );
+	if (hasPath(pRule, pSection, pCondition)) {
+		return safeRegex(normalizeToREAsString(get(pRule[pSection], pCondition)), {
+			limit: MAX_SAFE_REGEX_STAR_REPEAT_LIMIT,
+		});
+	}
+	return true;
 }
 
 function assertRuleSafety(pRule) {
-  const lRegexConditions = [
-    { section: "from", condition: "path" },
-    { section: "to", condition: "path" },
-    { section: "from", condition: "pathNot" },
-    { section: "to", condition: "pathNot" },
-    { section: "to", condition: "license" },
-    { section: "to", condition: "licenseNot" },
-    { section: "to", condition: "via" },
-    { section: "to", condition: "via.path" },
-    { section: "to", condition: "viaNot" },
-    { section: "to", condition: "viaNot.path" },
-    { section: "to", condition: "viaOnly" },
-    { section: "to", condition: "viaOnly.path" },
-    { section: "to", condition: "viaSomeNot" },
-    { section: "to", condition: "viaSomeNot.path" },
-  ];
+	const lRegexConditions = [
+		{ section: "from", condition: "path" },
+		{ section: "to", condition: "path" },
+		{ section: "from", condition: "pathNot" },
+		{ section: "to", condition: "pathNot" },
+		{ section: "to", condition: "license" },
+		{ section: "to", condition: "licenseNot" },
+		{ section: "to", condition: "via" },
+		{ section: "to", condition: "via.path" },
+		{ section: "to", condition: "viaNot" },
+		{ section: "to", condition: "viaNot.path" },
+		{ section: "to", condition: "viaOnly" },
+		{ section: "to", condition: "viaOnly.path" },
+		{ section: "to", condition: "viaSomeNot" },
+		{ section: "to", condition: "viaSomeNot.path" },
+	];
 
-  if (
-    lRegexConditions.some(
-      (pCondition) =>
-        !safeRule(pRule, pCondition.section, pCondition.condition),
-    )
-  ) {
-    throw new Error(
-      `rule ${JSON.stringify(
-        pRule,
-        null,
-        "",
-      )} has an unsafe regular expression. Bailing out.\n`,
-    );
-  }
+	if (
+		lRegexConditions.some(
+			(pCondition) =>
+				!safeRule(pRule, pCondition.section, pCondition.condition),
+		)
+	) {
+		throw new Error(
+			`rule ${JSON.stringify(
+				pRule,
+				null,
+				"",
+			)} has an unsafe regular expression. Bailing out.\n`,
+		);
+	}
 }
 
 /**
  * Returns the passed configuration pConfiguration when it is valid.
  * Throws an Error in all other cases.
  *
- * Validations:
- * - the rule set adheres to the [config json schema](../../schema/configuration.schema.json)
- * - any regular expression in the rule set is 'safe' (~= won't be too slow)
- *
  * @param  {IConfiguration} pConfiguration The configuration to validate
- * @return {IConfiguration}  The configuration as passed
- * @throws {Error}                 An error with the reason for the error as
- *                                 a message
+ * @return {IConfiguration} The configuration as passed
+ * @throws {Error}          An error with the reason for the error as a message
  */
 export default function assertRuleSetValid(pConfiguration) {
-  assertSchemaCompliance(configurationSchema, pConfiguration);
-  (pConfiguration.allowed || []).forEach(assertRuleSafety);
-  (pConfiguration.forbidden || []).forEach(assertRuleSafety);
-  if (pConfiguration?.options) {
-    assertCruiseOptionsValid(pConfiguration.options);
-  }
-  return pConfiguration;
+	bus.info("parse rule set: validate");
+
+	bus.debug("parse rule set: validate: schema compliance");
+	assertSchemaCompliance(pConfiguration);
+
+	bus.debug("parse rule set: validate: rule safety");
+	(pConfiguration.allowed || []).forEach(assertRuleSafety);
+	(pConfiguration.forbidden || []).forEach(assertRuleSafety);
+
+	bus.debug("parse rule set: validate: cruise options validity");
+	if (pConfiguration?.options) {
+		assertCruiseOptionsValid(pConfiguration.options);
+	}
+	return pConfiguration;
 }
 
 /* think we can ignore object injection here because it's not a public function */